Registries in the EU must now keep accurate holder data and check it. The check lands on whoever is the registered holder, which is the point where a trustee arrangement gets tested.
Registries must verify holder data, and each of the ones we cover does it differently. The check goes to the registered holder. On a trustee-held name that is the trustee, so you depend on them to receive the notice, answer it and keep the name out of suspension.
What Article 28 requires
The NIS2 Directive (EU) 2022/2555 sets five duties for top-level domain registries and registration providers in Article 28:
- collect accurate and complete registration data (28(1));
- hold enough to identify and contact each holder (28(2));
- publish verification procedures (28(3));
- publish the non-personal data without undue delay (28(4));
- answer lawful, substantiated access requests, in any event within 72 hours (28(5)).
Each member state writes this into its own law, so dates and methods differ. Norway is in the EEA, but the Norid pages we read do not mention the Directive.
What each registry has published
| Registry | What it says it does | Date |
|---|---|---|
| EURid, .eu | May verify at any time. The holder gets an email to confirm data in my.eurid.eu. A new name stays inactive until it passes; a failed existing name is suspended and scheduled for revocation, and cannot move registrar. Disclosure within 72 hours, 24 for urgent cases. | October 2024 |
| DENIC, .de | Name, postal address, phone and email must be accurate. Checks run through the provider and are risk-based. Unverified names leave the zone, then are deleted. | Page undated, 2026 |
| Afnic, .fr | The Naming Policy does not mention NIS2. Paragraphs 65 to 70 set a verification step, then a substantiation step that suspends the holder's portfolio for up to 7 days, blocks it for up to 30, then deletes it. | July 2026 |
| Registro.it, .it | A data-accuracy verification system since May 2024. From January to April 2026 it ran 109 procedures covering 270 domains: 242 revoked, 4 approved, 24 open. | May 2024, April 2026 |
| Punktum dk, .dk | Danish registrants verify through MitID within 30 days. Foreign registrants go through a risk engine and may upload ID and proof of address within 25 days. Failure suspends the domain, then cancels it. | Page undated, 2026 |
| SIDN, .nl | Law in force since August 2026. SIDN checks on suspicion of fraud, with 3 working days to show ID. Registering in a third party's name has breached its terms (Article 1.2) since October 2023. | August 2026 |
| DNS Belgium, .be | Flagged names stay undelegated until the holder proves identity through itsme, eID, iDIN or Onfido. | Page undated, 2026 |
| Internetstiftelsen, .se | ID at registration, then cross-checks against company and population registers. NIS2 not mentioned. | Page undated, 2026 |
| Norid, .no | Checks the Brønnøysund and population registers before granting a name, and daily that organisations still exist. NIS2 not mentioned. | February 2025 |
Austria is the clearest dated case: nic.at's law takes effect on 1 October 2026, with 14 days to answer, then a 7-day final request, then a server hold. See the methodology for how we date and source registry pages.
What it means with a trustee
Whose identity is checked
The registered holder's. Where the trustee is the holder (.eu, .fr), the registry tests the trustee's data and the notice goes to the trustee's email. Where you are the holder and the provider only supplies a local contact, as on .de, the check is yours.
The risks that follow
Watch out
Three ways a failed check reaches your name
- A missed notice. EURid and Punktum dk suspend on a missed deadline. Ask your trustee how it forwards them.
- A shared fate. Afnic deletes the holder's whole portfolio. A trustee holding many customers' names under one record can put yours in that pool.
- No way out. EURid bars a registrar transfer while a name is suspended, so you cannot move it mid-check.
Two registries address third-party holding in terms. SIDN treats it as a breach, and the Registro.it Whois policy says fiduciary registration is not permitted unless within a trust.
Keep reading
Common questions
Will a registry ask for my passport if a trustee holds the name?
Not usually. It asks the registered holder, which is the trustee. Your own documents are requested only where you are the holder, or where your trustee's contract asks for them.
Does Afnic cite NIS2 in its .fr policy?
Not in the July 2026 Naming Policy we read. Its verification and substantiation steps stand on their own paragraphs.
What if the check fails on a trustee-held name?
The name is suspended or scheduled for revocation, depending on the registry. Your remedy is the trustee agreement, so read its notice and cooperation clauses before you buy.
Sources
- NIS2 Directive, Article 28 (consolidated text)
- EURid, Registration Data Verification Policy, version 1.0, October 2024
- EURid, new policies to comply with Belgian law, October 2024
- DENIC, NIS2 verification
- Afnic Naming Policy, 6 July 2026
- Registro .it, quarterly magazine no. 1, 2026
- Registro .it, DBNA and WHOIS Policy, version 2.2
- Punktum dk, data and ID verification of registrants
- SIDN, Cyberbeveiligingswet and domain registrations
- SIDN, verification of registration data
- DNS Belgium, registrant verification
- Internetstiftelsen, verification of domain holders
- Norid, measures to ensure the quality of customer data
- nic.at, NIS2 and NISG 2026
Last updated October 2026. Registries are still implementing national law and several pages carry no date. If something here is out of date, email info@trusteeindex.com.